1

I have a security requirement that after my application logs in a user, it should display the date and time of the user's most recent previous login. The Active Directory replicated "lastLogonTimeStamp" value is nowhere close to what is needed, so I wrote some code inspired from http://bit.ly/nf3wbM where I search the user in each domain controller in the domain, grab the "lastLogon" value and retain the maximum value. This value appears to be accurate.

The bad news is that my code found 100+ domain controllers and it takes 13 minutes to look up the user on all of them. I've logged into my own account and from debugging my code I have noticed that I have previously logged in to only 55 of those domain controllers. To make things more interesting, only 7 of those domain controllers show login times from today and my "logonCount" on those 7 domain controllers is above 1000 while on the other ones is in the single digits. If I alter my code to look up my account only on those 7 domain controllers, I can determine my most recent login time in under 7 seconds which is an acceptable performance.

The question I have to the community is what makes those 7 domain controllers special and how should I go about having my code look up the login stats only on those?

Thank you, eugen

1 Answer 1

2

Are you looking to track Windows logins, or just logins to your application?

Tracking for Windows logins got a lot easier with 2008, if that's what you're looking for:

Enable global tracking of last logon timestamp data; set this in a group policy that applies to your DCs (don't apply it to workstations without being aware of the caveats; this policy will prevent login for a system disconnected from the network):

Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Logon Options > Display information about previous logons during user logon

Then, the msDS-LastSuccessfulInteractiveLogonTime attribute will have consistent data replicated across the domain.

If you're looking to track just application logins, consider tracking the data in a schema attribute that you just write into yourself on a successful login.

1
  • Thanks, I'll look into this. The user logs into my application using a Windows/Active Directory credential that I verify calling the Win32 LogonUser API. The reason for this is that the user that runs the application is not necessarily the user who is logged into the computer (that happens to be an operator console). This blurs the line between Windows and application login, the user should see the most recent login to either Windows or application.
    – eugen_nw
    Sep 16, 2011 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .